US Seizes Infrastructure Used by North Korean Hackers in $400 Million Cryptocurrency Scam

The United States Justice Department announced on Thursday that it has seized cloud infrastructure used by North Korean hackers in a video-call scam that has reportedly stolen over $400 million in cryptocurrency over the past 18 months. The scam, dubbed FaceStealer by the FBI, involved hackers sending meeting invitations from compromised accounts of previous victims. Once a target joins the call, the hackers record their webcam feed and play a pre-recorded video of someone the target knows, creating the illusion of familiar faces.

The hackers used AI-generated deepfakes of prominent figures in the cryptocurrency space to execute their plan. They create a fake technical error and provide a link to resolve it, which actually installs malware. In some instances, they waited several months, or even over a year, before stealing funds, then leveraged the victim's contacts to target new victims. Most of the victims work in cryptocurrency or internet-related industries, and the hackers have begun to focus on open-source software developers to facilitate supply-chain attacks.

The FBI seized over 900 webcam videos of victims under a federal warrant. Patrick Grandy, head of the FBI's Los Angeles office, warned that the scam is highly sophisticated and that victims may not even realize they have been targeted. The FBI links FaceStealer to a hacking group known as Sapphire Sleet, distinct from the North Korean military hackers accused of the Binance theft.

In the Binance incident, the FBI reported that a group called TraderTraitor stole approximately $6 billion around October 29, marking it as the largest cryptocurrency theft to date. US agencies and private firms have since frozen over $2.7 billion of the stolen funds. Authorities typically submit a forfeiture claim in court, where a judge will determine rightful ownership of the recovered funds.

The US Justice Department also secured court approval to seize more than $1.2 billion linked to the recent Binance hack. According to M. Scott Proctor, the department's principal deputy assistant attorney general for national security, North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.

North Korea has denied any involvement in the Binance hack. The FBI's seizure of the cloud infrastructure used by the hackers is a significant blow to the FaceStealer scam. The US Justice Department's actions demonstrate its commitment to disrupting and dismantling cybercrime operations.

The FaceStealer scam highlights the growing threat of AI-generated deepfakes and the need for increased vigilance in the cryptocurrency space. As the use of deepfakes becomes more widespread, it is essential for individuals and organizations to be aware of the risks and take steps to protect themselves.

Key points

• The US Justice Department seized cloud infrastructure used by North Korean hackers in a $400 million cryptocurrency scam.
• The scam, dubbed FaceStealer, used AI-generated deepfakes to target victims.
• US agencies have frozen over $2.7 billion of stolen funds linked to the Binance hack.